sst 2.0.35 → 2.0.36

package/constructs/Api.d.ts

@@ -8,6 +8,7 @@ import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as logs from "aws-cdk-lib/aws-logs";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn, FunctionProps, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
+import { FunctionBindingProps } from "./util/functionBinding.js";
 import { Duration } from "./util/duration.js";
 import { Permissions } from "./util/permission.js";
 import * as apigV2Cors from "./util/apiGatewayV2Cors.js";
@@ -741,16 +742,7 @@ export declare class Api<Authorizers extends Record<string, ApiAuthorizer> = Rec
         };
     };
     /** @internal */
-    getFunctionBinding(): {
-        clientPackage: string;
-        variables: {
-            url: {
-                environment: string;
-                parameter: string;
-            };
-        };
-        permissions: {};
-    };
+    getFunctionBinding(): FunctionBindingProps;
     private createHttpApi;
     private addAuthorizers;
     private addRoute;

package/constructs/Api.js

@@ -244,8 +244,8 @@ export class Api extends Construct {
             clientPackage: "api",
             variables: {
                 url: {
-                    environment: this.customDomainUrl || this.url,
-                    parameter: this.customDomainUrl || this.url,
+                    type: "plain",
+                    value: this.customDomainUrl || this.url,
                 },
             },
             permissions: {},

package/constructs/ApiGatewayV1Api.d.ts

@@ -7,6 +7,7 @@ import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as apig from "aws-cdk-lib/aws-apigateway";
 import * as apigV1AccessLog from "./util/apiGatewayV1AccessLog.js";
 import { Bucket } from "./Bucket.js";
+import { FunctionBindingProps } from "./util/functionBinding.js";
 import { Duration } from "./util/duration.js";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn, FunctionProps, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
@@ -622,16 +623,7 @@ export declare class ApiGatewayV1Api<Authorizers extends Record<string, ApiGatew
         };
     };
     /** @internal */
-    getFunctionBinding(): {
-        clientPackage: string;
-        variables: {
-            url: {
-                environment: string;
-                parameter: string;
-            };
-        };
-        permissions: {};
-    };
+    getFunctionBinding(): FunctionBindingProps;
     private createRestApi;
     private buildCorsConfig;
     private createGatewayResponseForCors;

package/constructs/ApiGatewayV1Api.js

@@ -234,8 +234,8 @@ export class ApiGatewayV1Api extends Construct {
             clientPackage: "api",
             variables: {
                 url: {
-                    environment: this.customDomainUrl || this.url,
-                    parameter: this.customDomainUrl || this.url,
+                    type: "plain",
+                    value: this.customDomainUrl || this.url,
                 },
             },
             permissions: {},

package/constructs/App.d.ts

@@ -1,6 +1,5 @@
 import * as cdk from "aws-cdk-lib";
 import * as lambda from "aws-cdk-lib/aws-lambda";
-import * as cxapi from "aws-cdk-lib/cx-api";
 import { SSTConstruct } from "./Construct.js";
 import { FunctionProps } from "./Function.js";
 import { Permissions } from "./util/permission.js";
@@ -172,7 +171,6 @@ export declare class App extends cdk.App {
      * Adds additional default layers to be applied to all Lambda functions in the stack.
      */
     addDefaultFunctionLayers(layers: lambda.ILayerVersion[]): void;
-    synth(options?: cdk.StageSynthesisOptions): cxapi.CloudAssembly;
     finish(): Promise<void>;
     isRunningSSTTest(): boolean;
     getInputFilesFromEsbuildMetafile(file: string): Array<string>;

package/constructs/App.js

@@ -202,8 +202,10 @@ export class App extends cdk.App {
             layers,
         });
     }
-    synth(options = {}) {
+    async finish() {
+        await useDeferredTasks().run();
         Auth.injectConfig();
+        this.buildConstructsMetadata();
         this.ensureUniqueConstructIds();
         this.codegenTypes();
         this.createBindingSsmParameters();
@@ -224,12 +226,6 @@ export class App extends cdk.App {
                 }
             }
         }
-        const cloudAssembly = super.synth(options);
-        return cloudAssembly;
-    }
-    async finish() {
-        await useDeferredTasks().run();
-        this.buildConstructsMetadata();
     }
     isRunningSSTTest() {
         // Check the env var set inside test/setup-tests.js

package/constructs/AppSyncApi.d.ts

@@ -10,6 +10,7 @@ import { RDS } from "./RDS.js";
 import * as appSyncApiDomain from "./util/appSyncApiDomain.js";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn, FunctionProps, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
+import { FunctionBindingProps } from "./util/functionBinding.js";
 import { Permissions } from "./util/permission.js";
 export interface AppSyncApiDomainProps extends appSyncApiDomain.CustomDomainProps {
 }
@@ -506,16 +507,7 @@ export declare class AppSyncApi extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): {
-        clientPackage: string;
-        variables: {
-            url: {
-                environment: string;
-                parameter: string;
-            };
-        };
-        permissions: {};
-    };
+    getFunctionBinding(): FunctionBindingProps;
     private createGraphApi;
     private addDataSource;
     private addResolver;

package/constructs/AppSyncApi.js

@@ -256,8 +256,8 @@ export class AppSyncApi extends Construct {
             clientPackage: "api",
             variables: {
                 url: {
-                    environment: this.customDomainUrl || this.url,
-                    parameter: this.customDomainUrl || this.url,
+                    type: "plain",
+                    value: this.customDomainUrl || this.url,
                 },
             },
             permissions: {},

package/constructs/Auth.js

@@ -2,7 +2,7 @@ import * as ssm from "aws-cdk-lib/aws-ssm";
 import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Construct } from "constructs";
 import { Stack } from "./Stack.js";
-import { ENVIRONMENT_PLACEHOLDER, getEnvironmentKey, getParameterPath, } from "./util/functionBinding.js";
+import { getEnvironmentKey, getParameterPath, placeholderSecretValue, } from "./util/functionBinding.js";
 import { CustomResource } from "aws-cdk-lib";
 const PUBLIC_KEY_PROP = "publicKey";
 const PRIVATE_KEY_PROP = "privateKey";
@@ -76,10 +76,13 @@ export class Auth extends Construct {
             clientPackage: "auth",
             variables: {
                 publicKey: {
-                    environment: ENVIRONMENT_PLACEHOLDER,
-                    // SSM parameters will be created by the custom resource
-                    parameter: undefined,
+                    type: "secret",
                 },
+                // Example of referencing a secret
+                //publicKey2: {
+                //  type: "secret_reference",
+                //  secret: this.publicKey2,
+                //},
             },
             permissions: {
                 "ssm:GetParameters": [
@@ -123,12 +126,12 @@ export class Auth extends Construct {
             });
             // Auth construct has two types of Function bindinds:
             // - Api routes: bindings defined in `getFunctionBinding()`
-            //     ie. calling `use.([auth])` will grant functions access to the public key
+            //     ie. calling `bind([auth])` will grant functions access to the public key
             // - Auth authenticator: binds manually. Need to grant access to the prefix and private key
             const fn = props.api.getFunction(path);
             fn.addEnvironment(getEnvironmentKey(this, PREFIX_PROP), prefix);
-            fn.addEnvironment(getEnvironmentKey(this, PUBLIC_KEY_PROP), ENVIRONMENT_PLACEHOLDER);
-            fn.addEnvironment(getEnvironmentKey(this, PRIVATE_KEY_PROP), ENVIRONMENT_PLACEHOLDER);
+            fn.addEnvironment(getEnvironmentKey(this, PUBLIC_KEY_PROP), placeholderSecretValue());
+            fn.addEnvironment(getEnvironmentKey(this, PRIVATE_KEY_PROP), placeholderSecretValue());
             fn.attachPermissions([
                 new PolicyStatement({
                     actions: ["ssm:GetParameters"],

package/constructs/Bucket.d.ts

@@ -4,6 +4,7 @@ import { Queue } from "./Queue.js";
 import { Topic } from "./Topic.js";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn, FunctionProps, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
+import { FunctionBindingProps } from "./util/functionBinding.js";
 import { Permissions } from "./util/permission.js";
 import { Duration } from "./util/duration.js";
 export interface BucketCorsRule {
@@ -339,18 +340,7 @@ export declare class Bucket extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): {
-        clientPackage: string;
-        variables: {
-            bucketName: {
-                environment: string;
-                parameter: string;
-            };
-        };
-        permissions: {
-            "s3:*": string[];
-        };
-    };
+    getFunctionBinding(): FunctionBindingProps;
     private createBucket;
     private addNotification;
     private addQueueNotification;

package/constructs/Bucket.js

@@ -161,8 +161,8 @@ export class Bucket extends Construct {
             clientPackage: "bucket",
             variables: {
                 bucketName: {
-                    environment: this.bucketName,
-                    parameter: this.bucketName,
+                    type: "plain",
+                    value: this.bucketName,
                 },
             },
             permissions: {

package/constructs/EventBus.d.ts

@@ -5,6 +5,7 @@ import * as eventsTargets from "aws-cdk-lib/aws-events-targets";
 import { Queue } from "./Queue.js";
 import { SSTConstruct } from "./Construct.js";
 import { FunctionProps, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
+import { FunctionBindingProps } from "./util/functionBinding.js";
 import { Permissions } from "./util/permission.js";
 /**
  * Used to configure an EventBus function target
@@ -375,18 +376,7 @@ export declare class EventBus extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): {
-        clientPackage: string;
-        variables: {
-            eventBusName: {
-                environment: string;
-                parameter: string;
-            };
-        };
-        permissions: {
-            "events:*": string[];
-        };
-    };
+    getFunctionBinding(): FunctionBindingProps;
     private createEventBus;
     private addRule;
     private addTarget;

package/constructs/EventBus.js

@@ -215,8 +215,8 @@ export class EventBus extends Construct {
             clientPackage: "event-bus",
             variables: {
                 eventBusName: {
-                    environment: this.eventBusName,
-                    parameter: this.eventBusName,
+                    type: "plain",
+                    value: this.eventBusName,
                 },
             },
             permissions: {

package/constructs/Function.d.ts

@@ -7,6 +7,7 @@ import { Stack } from "./Stack.js";
 import { SSTConstruct } from "./Construct.js";
 import { Size } from "./util/size.js";
 import { Duration } from "./util/duration.js";
+import { FunctionBindingProps } from "./util/functionBinding.js";
 import { Permissions } from "./util/permission.js";
 import * as functionUrlCors from "./util/functionUrlCors.js";
 declare const supportedRuntimes: {
@@ -552,6 +553,7 @@ export declare class Function extends lambda.Function implements SSTConstruct {
     _disableBind?: boolean;
     private functionUrl?;
     private props;
+    private allBindings;
     constructor(scope: Construct, id: string, props: FunctionProps);
     /**
      * The AWS generated URL of the Function.
@@ -585,18 +587,7 @@ export declare class Function extends lambda.Function implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): {
-        clientPackage: string;
-        variables: {
-            functionName: {
-                environment: string;
-                parameter: string;
-            };
-        };
-        permissions: {
-            "lambda:*": string[];
-        };
-    };
+    getFunctionBinding(): FunctionBindingProps;
     private createUrl;
     private isNodeRuntime;
     static validateHandlerSet(id: string, props: FunctionProps): void;

package/constructs/Function.js

@@ -11,7 +11,7 @@ import { Job } from "./Job.js";
 import { Secret } from "./Config.js";
 import { toCdkSize } from "./util/size.js";
 import { toCdkDuration } from "./util/duration.js";
-import { bindEnvironment, bindPermissions } from "./util/functionBinding.js";
+import { bindEnvironment, bindPermissions, getReferencedSecrets, } from "./util/functionBinding.js";
 import { attachPermissionsToRole } from "./util/permission.js";
 import * as functionUrlCors from "./util/functionUrlCors.js";
 import url from "url";
@@ -67,6 +67,7 @@ export class Function extends lambda.Function {
     _disableBind;
     functionUrl;
     props;
+    allBindings = [];
     constructor(scope, id, props) {
         const app = scope.node.root;
         const stack = Stack.of(scope);
@@ -254,7 +255,10 @@ export class Function extends lambda.Function {
      * ```
      */
     bind(constructs) {
-        constructs.forEach((c) => {
+        // Get referenced secrets
+        const referencedSecrets = [];
+        constructs.forEach((c) => referencedSecrets.push(...getReferencedSecrets(c)));
+        [...constructs, ...referencedSecrets].forEach((c) => {
             // Bind environment
             const env = bindEnvironment(c);
             Object.entries(env).forEach(([key, value]) => this.addEnvironment(key, value));
@@ -268,6 +272,7 @@ export class Function extends lambda.Function {
                 }),
             ]));
         });
+        this.allBindings.push(...constructs, ...referencedSecrets);
     }
     /**
      * Attaches additional permissions to function.
@@ -291,13 +296,12 @@ export class Function extends lambda.Function {
     }
     /** @internal */
     getConstructMetadata() {
-        const { bind } = this.props;
         return {
             type: "Function",
             data: {
                 arn: this.functionArn,
                 localId: this.node.addr,
-                secrets: (bind || [])
+                secrets: this.allBindings
                     .filter((c) => c instanceof Secret)
                     .map((c) => c.name),
             },
@@ -309,8 +313,8 @@ export class Function extends lambda.Function {
             clientPackage: "function",
             variables: {
                 functionName: {
-                    environment: this.functionName,
-                    parameter: this.functionName,
+                    type: "plain",
+                    value: this.functionName,
                 },
             },
             permissions: {

package/constructs/Job.d.ts

@@ -3,6 +3,7 @@ import { SSTConstruct } from "./Construct.js";
 import { Function } from "./Function.js";
 import { Duration } from "./util/duration.js";
 import { Permissions } from "./util/permission.js";
+import { FunctionBindingProps } from "./util/functionBinding.js";
 import { IVpc } from "aws-cdk-lib/aws-ec2";
 export type JobMemorySize = "3 GB" | "7 GB" | "15 GB" | "145 GB";
 export interface JobProps {
@@ -147,18 +148,7 @@ export declare class Job extends Construct implements SSTConstruct {
         data: {};
     };
     /** @internal */
-    getFunctionBinding(): {
-        clientPackage: string;
-        variables: {
-            functionName: {
-                environment: string;
-                parameter: string;
-            };
-        };
-        permissions: {
-            "lambda:*": string[];
-        };
-    };
+    getFunctionBinding(): FunctionBindingProps;
     /**
      * Binds additional resources to job.
      *
@@ -193,7 +183,7 @@ export declare class Job extends Construct implements SSTConstruct {
     private updateCodeBuildProjectCode;
     private createLocalInvoker;
     private createCodeBuildInvoker;
-    private useForCodeBuild;
+    private bindForCodeBuild;
     private attachPermissionsForCodeBuild;
     private addEnvironmentForCodeBuild;
     private normalizeMemorySize;

package/constructs/Job.js

@@ -10,7 +10,7 @@ import { Stack } from "./Stack.js";
 import { Function, useFunctions } from "./Function.js";
 import { toCdkDuration } from "./util/duration.js";
 import { attachPermissionsToRole } from "./util/permission.js";
-import { bindEnvironment, bindPermissions } from "./util/functionBinding.js";
+import { bindEnvironment, bindPermissions, getReferencedSecrets, } from "./util/functionBinding.js";
 import { useDeferredTasks } from "./deferred_task.js";
 import { useProject } from "../project.js";
 import { useRuntimeHandlers } from "../runtime/handlers.js";
@@ -79,8 +79,8 @@ export class Job extends Construct {
             clientPackage: "job",
             variables: {
                 functionName: {
-                    environment: this._jobInvoker.functionName,
-                    parameter: this._jobInvoker.functionName,
+                    type: "plain",
+                    value: this._jobInvoker.functionName,
                 },
             },
             permissions: {
@@ -98,7 +98,7 @@ export class Job extends Construct {
      */
     bind(constructs) {
         this._jobInvoker.bind(constructs);
-        this.useForCodeBuild(constructs);
+        this.bindForCodeBuild(constructs);
     }
     /**
      * Attaches the given list of [permissions](Permissions.md) to the job. This allows the job to access other AWS resources.
@@ -265,9 +265,11 @@ export class Job extends Construct {
         fn._disableBind = true;
         return fn;
     }
-    useForCodeBuild(constructs) {
-        const app = this.node.root;
-        constructs.forEach((c) => {
+    bindForCodeBuild(constructs) {
+        // Get referenced secrets
+        const referencedSecrets = [];
+        constructs.forEach((c) => referencedSecrets.push(...getReferencedSecrets(c)));
+        [...constructs, ...referencedSecrets].forEach((c) => {
             // Bind environment
             const env = bindEnvironment(c);
             Object.entries(env).forEach(([key, value]) => this.addEnvironmentForCodeBuild(key, value));

package/constructs/KinesisStream.d.ts

@@ -3,6 +3,7 @@ import * as kinesis from "aws-cdk-lib/aws-kinesis";
 import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn, FunctionProps, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
+import { FunctionBindingProps } from "./util/functionBinding.js";
 import { Permissions } from "./util/permission.js";
 /**
  * Used to define the function consumer for the stream
@@ -217,18 +218,7 @@ export declare class KinesisStream extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): {
-        clientPackage: string;
-        variables: {
-            streamName: {
-                environment: string;
-                parameter: string;
-            };
-        };
-        permissions: {
-            "kinesis:*": string[];
-        };
-    };
+    getFunctionBinding(): FunctionBindingProps;
     private createStream;
     private addConsumer;
 }

package/constructs/KinesisStream.js

@@ -152,8 +152,8 @@ export class KinesisStream extends Construct {
             clientPackage: "kinesis-stream",
             variables: {
                 streamName: {
-                    environment: this.streamName,
-                    parameter: this.streamName,
+                    type: "plain",
+                    value: this.streamName,
                 },
             },
             permissions: {

package/constructs/NextjsSite.js

@@ -84,51 +84,40 @@ export class NextjsSite extends SsrSite {
     createMiddlewareEdgeFunctionForRegional() {
         const { permissions, environment, path: sitePath } = this.props;
         const middlewarePath = path.resolve(sitePath, ".open-next/middleware-function");
-        const isMiddlewareEnabled = fs.existsSync(middlewarePath);
-        let bundlePath, handler;
-        if (isMiddlewareEnabled) {
-            bundlePath = middlewarePath;
-            handler = "index.handler";
+        if (fs.existsSync(middlewarePath)) {
+            return new EdgeFunction(this, "Middleware", {
+                bundlePath: middlewarePath,
+                handler: "index.handler",
+                timeout: 5,
+                memorySize: 128,
+                permissions,
+                environment,
+                format: "esm",
+            });
         }
-        else {
-            bundlePath = path.resolve(__dirname, "../support/ssr-site-function-stub");
-            handler = "server.handler";
-        }
-        const fn = new EdgeFunction(this, "Middleware", {
-            bundlePath,
-            handler,
-            timeout: 5,
-            memorySize: 128,
-            permissions,
-            environment,
-            format: "esm",
-        });
-        return { fn, isMiddlewareEnabled };
     }
     createCloudFrontDistributionForRegional() {
         const { cdk } = this.props;
         const cfDistributionProps = cdk?.distribution || {};
         const s3Origin = new origins.S3Origin(this.cdk.bucket);
         // Create server behavior
-        const { fn: middlewareFn, isMiddlewareEnabled } = this.createMiddlewareEdgeFunctionForRegional();
-        const fnUrl = this.serverLambdaForRegional.addFunctionUrl({
+        const middlewareFn = this.createMiddlewareEdgeFunctionForRegional();
+        const serverFnUrl = this.serverLambdaForRegional.addFunctionUrl({
             authType: lambda.FunctionUrlAuthType.NONE,
         });
         const serverBehavior = {
             viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-            origin: new origins.HttpOrigin(Fn.parseDomainName(fnUrl.url)),
+            origin: new origins.HttpOrigin(Fn.parseDomainName(serverFnUrl.url)),
             allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
             cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
             compress: true,
             cachePolicy: cdk?.serverCachePolicy ?? this.createCloudFrontServerCachePolicy(),
-            edgeLambdas: isMiddlewareEnabled
-                ? [
-                    {
-                        eventType: cloudfront.LambdaEdgeEventType.VIEWER_REQUEST,
-                        functionVersion: middlewareFn.currentVersion,
-                    },
-                ]
-                : undefined,
+            edgeLambdas: middlewareFn && [
+                {
+                    eventType: cloudfront.LambdaEdgeEventType.VIEWER_REQUEST,
+                    functionVersion: middlewareFn.currentVersion,
+                },
+            ],
         };
         // Create image optimization behavior
         const imageFn = this.createImageOptimizationFunctionForRegional();

package/constructs/Parameter.d.ts

@@ -1,5 +1,6 @@
 import { Construct } from "constructs";
 import { SSTConstruct } from "./Construct.js";
+import { FunctionBindingProps } from "./util/functionBinding.js";
 export interface ParameterProps {
     /**
      * Value of the parameter
@@ -31,15 +32,6 @@ export declare class Parameter extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): {
-        clientPackage: string;
-        variables: {
-            value: {
-                environment: string;
-                parameter: string;
-            };
-        };
-        permissions: {};
-    };
+    getFunctionBinding(): FunctionBindingProps;
     static create<T extends Record<string, any>>(scope: Construct, parameters: T): { [key in keyof T]: Parameter; };
 }

package/constructs/Parameter.js

@@ -36,8 +36,8 @@ export class Parameter extends Construct {
             clientPackage: "config",
             variables: {
                 value: {
-                    environment: this.value,
-                    parameter: this.value,
+                    type: "plain",
+                    value: this.value,
                 },
             },
             permissions: {},

package/constructs/Queue.d.ts

@@ -4,6 +4,7 @@ import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
+import { FunctionBindingProps } from "./util/functionBinding.js";
 import { Permissions } from "./util/permission.js";
 /**
  * Used to define the consumer for the queue and invocation details
@@ -188,17 +189,6 @@ export declare class Queue extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): {
-        clientPackage: string;
-        variables: {
-            queueUrl: {
-                environment: string;
-                parameter: string;
-            };
-        };
-        permissions: {
-            "sqs:*": string[];
-        };
-    };
+    getFunctionBinding(): FunctionBindingProps;
     private createQueue;
 }

package/constructs/Queue.js

@@ -161,8 +161,8 @@ export class Queue extends Construct {
             clientPackage: "queue",
             variables: {
                 queueUrl: {
-                    environment: this.queueUrl,
-                    parameter: this.queueUrl,
+                    type: "plain",
+                    value: this.queueUrl,
                 },
             },
             permissions: {